Browse CVEs

CRITICAL 9.8 CVE-2024-31615 ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. Thinkcmf No fix yet Fix from $2,3002024-04-25 MEDIUM 5.4 CVE-2020-25915 Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user… Thinkcmf Mitigation only Fix from $1,6002023-08-11 HIGH 8.8 CVE-2022-40489 ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into ad… Thinkcmf No fix yet Fix from $1,9502022-12-01 MEDIUM 5.4 CVE-2022-40849 ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Per… Thinkcmf No fix yet Fix from $1,6002022-12-01 MEDIUM 6.5 CVE-2021-40616 thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background… Thinkcmf No fix yet Fix from $1,6002022-06-14 CRITICAL 9.8 CVE-2020-20601EPSS 8% An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. Thinkcmf No fix yet Fix from $2,3002021-12-22 MEDIUM 6.5 CVE-2020-18151 Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. Thinkcmf No fix yet Fix from $1,6002021-07-14 HIGH 8.8 CVE-2019-7580EPSS 10% ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mish… Thinkcmf No fix yet Fix from $1,9502019-02-07 CRITICAL 9.8 CVE-2019-6713 app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving port… Thinkcmf Mitigation only Fix from $2,3002019-01-23 HIGH 8.8 CVE-2018-19898 ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the po… Thinkcmf No fix yet Fix from $1,9502018-12-06 HIGH 7.2 CVE-2018-19894 ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager priv… Thinkcmf No fix yet Fix from $1,9502018-12-06 HIGH 7.2 CVE-2018-19895 ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the paren… Thinkcmf No fix yet Fix from $1,9502018-12-06 HIGH 7.2 CVE-2018-19896 ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] … Thinkcmf No fix yet Fix from $1,9502018-12-06 HIGH 7.2 CVE-2018-19897 ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via t… Thinkcmf No fix yet Fix from $1,9502018-12-06 MEDIUM 6.5 CVE-2018-16141 ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl p… Thinkcmfx No fix yet Fix from $1,6002018-08-30